MAG212 CYBER ORIGINAL ARTICLE

CopperDragon’s “Sparrow” Toolkit Ties Three China-Nexus Espionage Campaigns Together

November 11, 2026 · El Mostafa Ouchen

MAG212 CYBER illustration: a central toolkit node feeding three separate campaign clusters across a world network, headline 'One toolkit, three espionage campaigns'.

After a year-long investigation, Check Point Research says three espionage campaigns that looked separate share the same engineering underneath. SilentDelivery, OceanGate and DarkWire all use a framework CPR calls Sparrow, which it suggests is supplied by a developer it names CopperDragon. Their targets are telecom providers, governments, militaries, research bodies and critical infrastructure in 21 countries, and their entry points range from a fake browser certificate warning to brute-forced RDP.

What happened

[Confirmed] After a year-long investigation, Check Point Research linked three clusters, SilentDelivery, OceanGate and DarkWire, through a shared framework it calls Sparrow, which it suggests is supplied by a developer it names CopperDragon. Targets: telecom providers, government, military, research and critical infrastructure in 21 countries. CPR warns a telecom compromise could expose call records, subscriber locations, SMS and possibly lawful-intercept systems. (Check Point) (Check Point Research)

Diagram: CopperDragon above the Sparrow framework, linked to SilentDelivery, OceanGate and DarkWire with each cluster's way in.
Figure 6 · One toolkit, three campaigns. Check Point links three clusters through the Sparrow framework. CopperDragon’s role as supplier is assessed (dashed), with no formal confidence level. Diagram: MAG212 CYBER

How each cluster gets in

  • SilentDelivery (Europe/Asia, 2026): obfuscated JavaScript on legitimate sites fingerprints visitors and shows a fake Chrome certificate warning offering a “Certificate Fix”, a trojanized MSI that drops a backdoor. Also LNK files disguised as PDFs sent to Indonesian organisations. (The Hacker News)
  • OceanGate (2025–26, India focus): a “vulnerable internet-facing Linux server”, with no product or CVE named, then RDP brute force to an admin account; Linux backdoors with an optional rootkit, Windows keylogger and credential stealers. (The Hacker News)
  • DarkWire (mid-2025, Latin American telecom and government): DLL sideloading, DNS tunnelling over MX queries, C2 often in the victim’s own country. (The Hacker News) ESET documented related Sparrow activity in Latin America in September. (CSA)

Attribution: assessed, not proven

[Reported] CopperDragon is “assessed” to supply FamousSparrow, Earth Estries, Tropic Trooper, UAT-9244 and UAT-8302; FamousSparrow’s relationship to Salt Typhoon “remains unclear”. (The Hacker News) [Confirmed] CPR’s own caveat: shared malware or C2 “does not necessarily mean” the same actor, and it gives no formal confidence level. (Check Point) [Unknown] No government corroboration found. We say “shared toolkit links three campaigns”, not “one group”.

What to look for, and what to do

CPR publishes domains, IP addresses and file hashes, plus host artifacts: a Run-key persistence value, a local account added to Administrators with remote token filtering disabled, custom firewall rules, distinctive C2 HTTP paths and a renamed LSASS dump. We don’t reprint the values: copy them verbatim from the Check Point Research report into your tooling. Check Point’s guidance, in order: (Check Point)

  1. Sweep DNS, proxy and EDR telemetry for CPR’s domains, IPs and hashes; hunt the host artifacts.
  2. Treat any “certificate fix” or update utility as suspicious. [MAG212 analysis] Block unsigned MSIs from browser download folders.
  3. Monitor for malicious DLL loading, credential dumping, keylogging and new persistence.
  4. Restrict and monitor RDP, SMB and SSH, especially brute force on internet-facing hosts.
  5. Inspect DNS, including tunnelling over MX, and unusual outbound traffic; inventory and patch internet-facing Linux servers.

Verify: [MAG212 analysis] after removal, the rogue account and firewall rules are gone and token-filtering policy is back to baseline; rotate credentials on any host with credential-dumping artifacts.

Why it matters

When several intrusion sets draw on one supplier, defenders who detect the shared tooling can catch activity that per-group threat profiles would miss. Telecom compromises are especially serious: CPR warns they can expose call records, subscriber locations, SMS and possibly lawful-intercept systems. The fake “Certificate Fix” lure also reaches far beyond telecom, to any user who trusts a browser warning.

The bottom line

Load Check Point’s published domains, IPs and hashes into your tooling verbatim, hunt for the host artifacts, block unsigned MSIs from browser download folders, and harden RDP, SMB, SSH and DNS on internet-facing systems.

How we label evidence: [Confirmed] comes from a primary source such as a vendor or CISA; [Reported] from a secondary outlet; [Claimed] from an attacker or an unverified party; [MAG212 analysis] is our judgement; [Unknown] means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.

This story is part of MAG212 CYBER Daily, 11 November 2026, with the day’s other verified stories, the Defender’s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER. By El Mostafa Ouchen.